CISA Adds 7 Flaws to KEV Amid Active Exploitation by Flax Typhoon

On October 11, 2026, CISA added seven flaws to its Known Exploited Vulnerabilities catalog (bringing the total to 1,739); five of these were attributed to the China-based APT Flax Typhoon and are confirmed as actively exploited. The report highlights that CVSS scores did not change for these vulnerabilities and recommends that organizations prioritize remediation using both CVSS and CISA KEV to avoid misprioritization and increased risk.